…will be saying soon to API clients in this tutorial that don't have valid credentials! Yep, welcome back guys, this time to a tutorial that's making security exciting again! Seriously, I'm pumped to talk about authentication in an API... and in particular…

…Symfony 2.0, but was called “sub-requests”. In 2.2, the feature has been overhauled for flexibility, speed and security. Understanding Http Caching, ESI and Fragments¶ One of the best features of Symfony is its use of Edge Side Includes or ESI. This is…

…what's actually stored on this field is a "hash" or kind of "fingerprint" of the plaintext password and there are multiple hashing algorithms available. The one you're using is configured in config/packages/security.yaml: The encoders section says that whenever we encode…

…through PHP. If your server is configured to execute any file ending in .php through PHP, that is a huge security risk. Ok, back to butterflies and ice cream. Even after we add validation to guarantee that the uploaded file is actually an image, the…

…vendor/bin/phpspec run Booya! New plan time team! Let's add a method to the service where we can pass it the number of dinosaurs we want, how much security we want, and... it will take care of the rest! Let's examplify that…

…all of the users... though you should - ya know - use security to avoid this if it's a problem. Auto-increment IDs have another downside: when you use an auto-increment database id as the key in your API, it means that only your server…

…relations, IRIs, filtering and more. In part 2, we talked about security, logging in, adding authorization checks to operations, making it so that certain fields can be read or written only by specific users and some pretty serious work related to custom normalizers for even…

…worries, let's add the same admin "exception" that we've added to a few other places. Start with public function __construct() so we can autowire the Security service. I'll hit Alt + Enter and click "Initialized fields" to create that property and set it…

…to check whether or not a user has a role. But wait... when we needed to do that in our voter, we autowired a different service via the Security type-hint. Well... these are both ways to do the exact same thing: use whichever you…

…for now: the Doctrine data persister. After deserializing the data into a User object, running security checks and executing validation, API Platform finally says: It's time to save this resource! To figure out how to save the object, it loops over all of its…

…the owner, access denied! We assert that in our test. Now... I'm going to trick the security system! We're logged in as user2@example.com but the CheeseListing we're trying to update is owned by user1@example.com... which is why we…

…see that we're currently logged in. And now... gone! We are anonymous. Before we keep going with all this API & security goodness, our app has a bug. If we log in... as soon as the AJAX call finishes, we've made our Vue.js…

…pass it that plaintext property, which will be stored on the password property. That's both weird - because the password field should always be encrypted - and a potential security issue: if we somehow accidentally save the user at this moment, that plaintext password will go…

…Call it ArticleVoter. It's pretty common to have one voter per object that you need to decide access for. Let's go check it out src/Security/Voter/ArticleVoter.php: Nice! Voters are a bit simpler than authenticators: just two methods. Here's how…

…send again. Woh! It redirects us to /login? I did not see that coming. Sometimes the hardest part of security is figuring out what's happening when something unexpected occurs. So, let's figure out exactly what's going on here. When authentication fails, this…

…why are we talking about database relationship in the security tutorial? Am I wandering off-topic again? Well, only a little. Setting up database relations is always good practice. But, I have a real, dubious, security-related goal: this setup will lead us to some…

…to do with security! Think about it. What is registration? It's just a form that creates a new record in the User table. That's it! That's just database stuff. So then... why are we even talking about this in a security tutorial…

…the database, checking their password and even protecting ourselves from the Borg Collective... with CSRF tokens. So let's start to look at the second part of security: authorization. Authorization is all about deciding whether or not a user should have access to something. This…

…two steps. First, make sure that your checkbox has no value and that its name is _remember_me: That's the magic name that Symfony will look for. Second, in security.yaml, under your firewall, add a new remember_me section. Add two other keys…

…pff, life is easy! On a day-to-day basis, you'll spend most of your time in a controller where... well, there's really only two things you can do related to security. One, deny access, like, based on a role: Or two, figure…